Moheeb Zara ef34089e57 harden: isSafeDuesUrl requires literal https:// so app and DB CHECK agree ...

Edge URLs like https:example.com parse to protocol https: but lack //,
which the migration-050 CHECK rejects -- the admin would see a confusing
save failure instead of a clear validation error. Require the prefix so
the Zod boundary matches the data layer. Fail-closed either way; no
security impact.

2026-05-19 21:49:51 -07:00

..

actions

security: enforce https on dues_payment_methods.url at the data layer

2026-05-19 21:35:49 -07:00

door

fix(door): defeat DNS-rebind by connecting to a validated resolved IP (D12)

2026-05-19 01:33:01 -07:00

email

feat(notifications): P2b email transport seam (Resend via fetch)

2026-05-17 04:50:34 -07:00

notifications

notifications(P4f): audit fixes, lock down 047 + best-effort enqueue paths

2026-05-19 16:12:03 -07:00

secrets

fix(security): Phase 3 post-deploy audit — 2 P0 + P1 + P2 (R5)

2026-05-18 17:01:25 -07:00

stripe

fix(money): zero-decimal currency handling (D7)

2026-05-18 18:38:25 -07:00

supabase

refactor: generate and use Supabase TypeScript types

2026-03-11 08:12:39 +00:00

auth-actions.ts

fix(auth): unverified members cannot exercise roles; single-membership join (D2)

2026-05-18 18:30:20 -07:00

auth-config.ts

feat(auth): gate OAuth buttons on login behind config flags

2026-05-16 18:26:36 -07:00

auth-helpers.ts

fix(auth): unverified members cannot exercise roles; single-membership join (D2)

2026-05-18 18:30:20 -07:00

certifications-guard.ts

feat(certifications): server actions + page guard

2026-05-16 18:55:17 -07:00

certifications-logic.ts

feat(certifications): pure expiry/status logic + Zod schemas

2026-05-16 18:52:53 -07:00

classes-guard.ts

feat(classes): server actions + page guard

2026-05-16 19:32:17 -07:00

classes-logic.ts

feat(classes): optional required-form gate at signup (waiver-on-file)

2026-05-16 21:41:01 -07:00

door-guard.ts

feat(door): P2 connections + SSRF-safe executor + native adapter + audit

2026-05-16 20:31:43 -07:00

door-logic.ts

fix(door): defeat DNS-rebind by connecting to a validated resolved IP (D12)

2026-05-19 01:33:01 -07:00

door-slots-logic.ts

feat(door): P3-B pure slot allocator (lowest-free, range-generic) + tests

2026-05-16 21:07:36 -07:00

dues-payments-logic.ts

harden: isSafeDuesUrl requires literal https:// so app and DB CHECK agree

2026-05-19 21:49:51 -07:00

equipment-guard.ts

feat(equipment): server actions + page guard

2026-05-16 19:51:51 -07:00

equipment-logic.ts

feat(equipment): pure overlap/eligibility logic + Zod schemas

2026-05-16 19:50:00 -07:00

form-templates.ts

feat(forms): obvious publish flow, member Forms surface, templates (P8)

2026-05-16 17:41:16 -07:00

forms-guard.ts

feat(forms): space-scoped public URL /f/[space]/[slug] (P6)

2026-05-16 17:21:39 -07:00

forms-logic.ts

fix(forms): link by an email collected as a form field, not only submitter_email

2026-05-17 00:31:33 -07:00

forms-schema.ts

feat(forms): server actions, Zod schemas, and dynamic answer validation (Phase 2)

2026-05-16 14:51:20 -07:00

incident-logic.ts

feat(incidents): anonymous report tracking by token + public /track

2026-05-16 18:13:09 -07:00

invite-logic.ts

feat(invites): role-granting + usage-capped invites; audit hardening (P7)

2026-05-16 17:34:45 -07:00

markdown-anchors.ts

feat(markdown): KB/process render + working in-document anchor links

2026-05-16 19:11:49 -07:00

notifications-logic.ts

notifications(P4g): strip URLs from user-controlled render inputs

2026-05-19 17:24:01 -07:00

notifications-prefs-logic.ts

Add notification preferences and alternate dues payment options

2026-05-19 20:26:32 -07:00

paypal-logic.ts

refactor(paypal): extract + unit-test sync mapping; reuse auth helper (R3)

2026-05-18 13:13:16 -07:00

permissions-cache.ts

perf(ux): request-cached permission checks (dedupe RPC fan-out)

2026-05-17 01:36:54 -07:00

permissions-catalog.ts

feat(door): P1 member access cards + door permissions

2026-05-16 20:13:22 -07:00

permissions.ts

fix(auth): unverified members cannot exercise roles; single-membership join (D2)

2026-05-18 18:30:20 -07:00

presence-logic.ts

feat(attendance): richer /attendance (here-now, search, day filter, grouping)

2026-05-16 22:42:07 -07:00

profile-presets.ts

Add notification preferences and alternate dues payment options

2026-05-19 20:26:32 -07:00

role-labels.ts

feat: Customize hub + roles editor, terminal logo, invite links

2026-05-15 16:03:52 -07:00

security.ts

feat: comprehensive application audit and fixes

2026-03-11 08:18:57 +00:00

stripe-logic.ts

feat(billing): P1b pure Stripe dues logic + 10 tests

2026-05-17 02:59:02 -07:00

types.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

utils.ts

Initial commit from v0

2026-03-11 04:44:48 +00:00

validations.ts

Add notification preferences and alternate dues payment options

2026-05-19 20:26:32 -07:00